Choreograph: add 'when' per-row condition + '--role <name> <ids>' ad-hoc role assignment